hxxps://proposal-q1[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest

Analysis

user interaction
yes
max time kernel
351s
max time network
353s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/10/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://proposal-q1.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest
Sample261015-xhqcsszzct

Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
29	3404	msiexec.exe
30	3404	msiexec.exe
33	5028	rundll32.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (aabd5a2550667f57)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (aabd5a2550667f57)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=instance-ipy1v0-relay.screenconnect.com&p=443&s=037a6dba-2899-4029-a7d3-946d52cb2cb3&k=BgIAAACkAABSU0ExAAgAAAEAAQBNwzNoPkWWzH%2fa9z%2fPeiONpGniUH5Bghhkr%2fO4LbdIM3Wzr6esieRjKDAe3whOkddC8Mh7A%2fAxKPLzSOO9ibXIBUvW965wbgndW6sq%2buIxAANfzB7xmjXUMwBAXbFFw3GchmRX7%2bKt3PEkzMUjRFL8oy4fv6my98s8IHZvGJcegZIP8hWUzvEM4ZzDvmAeZ8L9Cjx4QZTzdP2yTZKXnDI%2fda8hovRloOg1ZAF9I9Wh91lW6ZwQ0R%2b5Z7k8RgSB3GtalVDzs6EtoB7dVMg2wtgYLgkZj%2bvubWx84HKrl1jvHUqzVf1K1tg97dvgROndq%2ft2maQU6D9sNig7ydkvOy7V&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAA37Er3ZEJ8E2t7rOrpKK77QAAAAACAAAAAAAQZgAAAAEAACAAAAAbCll5xUT1aAOSolOkz3DcnNpfvflZCq9VSn52xC7lDwAAAAAOgAAAAAIAACAAAABuZ77oG1pGhqNAdvRGtznEF9QaP%2fLl8DxmHOUuI4pqqKAEAAB5ehRtr8VLDTxk0JaVrRRTfuyQX9bUR7LoGbi5rxNC4WA%2f83r8fLKQr%2bxVzUbjbcnGhN8SZ0DfoEVAjrHrycxgpu7hqWrVt3uUdliMGVyBZwaSujEBmoaz0XaE%2bBzWMPlrrU5jleV2qnvUF8AS8X1Bqj7LHb9u7EnuJXsVD6GYJZwznUYBLwlZpGMXVqsmddkgQqsKKY4B8Eo8WZCBbJllSxdLBxKYH9dYUaSIHUAS8Fz9Yvtk8J83g1shSFyJD%2b6Ty5aWPr3yJH1ULDvwp0jRmtvuhb30RIT%2bd4O12wQV6nlkAhcYFbR2dvLMn4AB7vv0CNZijRnLa1f7QWtr%2bkdMd0mabM4A%2fbxlzWBRbuWABzI6sKY8s6L%2fxGeIkfr1MHNM0SfwrMx2aWcnrF7CR10w6nDsftEm9TuIoBBoxb2WMniqVrvu76C%2fbi8YkgjGh4Jp8hyp%2bTPAQPhNWl%2b7tBrxRZp202zkQ6wBjHKeS94q1W9RJaeXKFlnAhejggxNihOkx%2fMdDR9J%2fckzBZsWORHoiTrXN3DxLAvNDeODnmDdXRpkXSFLBNrV4ADBNQ2YlkFwrLYAPQO5qWXOcJp3Vg3Htify7EThcZXPIm8Zt%2fKVB%2fhvi4z0qyZcWU%2bCsi8ggPGYxJsrHX7H6S7S5PY99NLaNttPCq5BIRhdUICXOOsAP7Dt3a8g8zo4T3duZ3tPiE1adOz4c%2fQW6zI6CHoHJXhTSxc8mvd1wBgO3288VRHiCvDode57ZzsHoKGQdftMxTOoZeHqovtyBpKjmBGS4jOI5Txl0akMibwg8zUp7ndZMD%2f%2ft%2fC6cDLIGHk32Qod7XT7kEglAxvJkbJ9nwgkwLPu5FBUjyvCUC96K%2b8QDzXQzIFawVBHx6HrRPpcmgcMme5QmX378hnEeJcZ1q2%2bKnhKKM7UOv%2brtfgJ9Mn%2fz3yzoKQk48qJ2NKxC1jbZSvK226xJem%2fAMPgS%2bw%2fS9UywXIU3GhP8Q72MfM6nGAsB4GjCrrw%2ba61LkaczWE%2fyswZIzLExaSh3q5MehivFCnGwG8irzK2GTZOS%2bd81qSKzKolWvIc2Hrr08GNwi7U5JwhtfbeQVFgsPAdu4pPEg6%2bdpEzvwmw2P0rqtYqeFC8l%2fg8YFN%2bthTBlK88Ii5IDiIaRLWKBTtgvw%2fkW%2bxD%2f3z239%2fV8jgBHfinRUbyjDZnfTs4ZifhbzWlWguceit%2fmm6TcMab9hCdCcBH4XoEuFxsOpeFODlkpeexE7HOP9UIyA4g%2fTPZmPKgR%2bsTCLvbUkc6u3hQSx83BtnfAMxWaUeCVxPRU3S6mLWNYvw2D68Td62%2bRyUVWaTQQJuhSHhBn16w2SojXh6HxrNP7p1gmdEeoJXfYBc0bD8zK9rEYldKlk2L%2fJRDoejQJ77vvwKlmZdrRNtRORGQ2i9r4eKTmpwlh%2bDXzDro8%2fAFFzNAp125jH7iFNpjjudfkDU9wXq2kKEMCtOjyGoWEOHnYs68%2fA9FD8b%2fzuH3%2b3lI8KmvQXPG2PzqTtNz3Zf756EgZ3pXUpeErYddU8uNRJ1WUKBNEZXmPeNaNwFzUwIIQgWasM9Er%2fmju0AAAADVrA0cTdb1K0vS140C%2fSqSwbeoOngaUT%2fw%2b5wskmv4qWcQvXUUZKk16cE%2bmGeEDGxixEV%2fvWBMO63sw8j4520g\""	ScreenConnect.ClientService.exe

ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
backdoor rat
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
4524	ScreenConnect.ClientService.exe
3724	ScreenConnect.WindowsClient.exe
4196	ScreenConnect.WindowsClient.exe
4284	ScreenConnect.WindowsClient.exe
1272	ScreenConnect.WindowsBackstageShell.exe
5924	ScreenConnect.WindowsClient.exe

Loads dropped DLL 42 IoCs

pid	Process
2468	MsiExec.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
3236	rundll32.exe
2468	MsiExec.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
5028	rundll32.exe
2468	MsiExec.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
4540	rundll32.exe
1896	MsiExec.exe
1424	MsiExec.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800610061006200640035006100320035003500300036003600370066003500370029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\zeughtv5.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\zeughtv5.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\kcemrkni.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\kcemrkni.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\kcemrkni.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\w5k2pcxv.newcfg	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\w5k2pcxv.newcfg	ScreenConnect.ClientService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ScreenConnect.WindowsClient.exe.log	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\user.config	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\taskschd.msc	mmc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	ScreenConnect.WindowsBackstageShell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\w5k2pcxv.tmp	ScreenConnect.ClientService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	ScreenConnect.WindowsBackstageShell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	ScreenConnect.WindowsBackstageShell.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIAC55.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{188BAD0D-5099-690B-EEE5-5E61E76ECA3B}\DefaultIcon	msiexec.exe
File created	C:\Windows\SystemTemp\ScreenConnect\26.6.5.9742\Temp\ScreenConnect.ClientSetup.msi	ScreenConnect.WindowsClient.exe
File opened for modification	C:\Windows\Installer\e59a7a0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA985.tmp	msiexec.exe
File created	C:\Windows\Installer\wix{188BAD0D-5099-690B-EEE5-5E61E76ECA3B}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\e59a7a2.msi	msiexec.exe
File created	C:\Windows\Installer\{188BAD0D-5099-690B-EEE5-5E61E76ECA3B}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e59a7a0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{188BAD0D-5099-690B-EEE5-5E61E76ECA3B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9E3.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.ClientService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ScreenConnect.WindowsBackstageShell.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ScreenConnect.WindowsBackstageShell.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1788	chrome.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005768639d43407d4e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff0000000027010100008838015768639d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e841015768639d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f5768639d00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea715768639d00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2664	NETSTAT.EXE

Modifies data under HKEY_USERS 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseHoverTime = "750"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{BD472F60-27FA-11CF-B8B4-444553540000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000094ce3406d75cdd01	ScreenConnect.WindowsClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{23170F69-40C1-278A-1000-000100020000} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 010000000000000094ce3406d75cdd01	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinHorzGap = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinVertGap = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsBackstageShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinArrange = "8"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics\MinWidth = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsBackstageShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\Version = "436600837"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-aabd5a2550667f57	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0ED5-D2BC67E749B5}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D0DAB8819905B096EE5EE5167EE6ACB3	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\ProductName = "ScreenConnect Client (aabd5a2550667f57)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\066B344F3205BA51AADBA5520566F775\D0DAB8819905B096EE5EE5167EE6ACB3	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (aabd5a2550667f57)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0ED5-D2BC67E749B5}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (aabd5a2550667f57)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\PackageCode = "D0DAB8819905B096EE5EE5167EE6ACB3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-aabd5a2550667f57\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\ProductIcon = "C:\\Windows\\Installer\\{188BAD0D-5099-690B-EEE5-5E61E76ECA3B}\\DefaultIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\066B344F3205BA51AADBA5520566F775	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{C460F144-8994-4F48-A829-EA76357FFAE6}	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-0ED5-D2BC67E749B5}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D0DAB8819905B096EE5EE5167EE6ACB3\Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-0ED5-D2BC67E749B5}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-0ED5-D2BC67E749B5}\ = "ScreenConnect Client (aabd5a2550667f57) Credential Provider"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-aabd5a2550667f57\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D0DAB8819905B096EE5EE5167EE6ACB3\DeploymentFlags = "3"	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5924	ScreenConnect.WindowsClient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1604	msiexec.exe
1604	msiexec.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
4524	ScreenConnect.ClientService.exe
1032	chrome.exe
1032	chrome.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe
5192	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5780	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeShutdownPrivilege	3404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3404	msiexec.exe
Token: SeShutdownPrivilege	1032	chrome.exe
Token: SeCreatePagefilePrivilege	1032	chrome.exe
Token: SeSecurityPrivilege	1604	msiexec.exe
Token: SeCreateTokenPrivilege	3404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3404	msiexec.exe
Token: SeLockMemoryPrivilege	3404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3404	msiexec.exe
Token: SeMachineAccountPrivilege	3404	msiexec.exe
Token: SeTcbPrivilege	3404	msiexec.exe
Token: SeSecurityPrivilege	3404	msiexec.exe
Token: SeTakeOwnershipPrivilege	3404	msiexec.exe
Token: SeLoadDriverPrivilege	3404	msiexec.exe
Token: SeSystemProfilePrivilege	3404	msiexec.exe
Token: SeSystemtimePrivilege	3404	msiexec.exe
Token: SeProfSingleProcessPrivilege	3404	msiexec.exe
Token: SeIncBasePriorityPrivilege	3404	msiexec.exe
Token: SeCreatePagefilePrivilege	3404	msiexec.exe
Token: SeCreatePermanentPrivilege	3404	msiexec.exe
Token: SeBackupPrivilege	3404	msiexec.exe
Token: SeRestorePrivilege	3404	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
3404	msiexec.exe
3404	msiexec.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
1032	chrome.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
3724	ScreenConnect.WindowsClient.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe
2068	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5780	mmc.exe
5780	mmc.exe
1272	ScreenConnect.WindowsBackstageShell.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3228	1032	chrome.exe	85
PID 1032 wrote to memory of 2488	1032	chrome.exe	86
PID 1032 wrote to memory of 2488	1032	chrome.exe	86
PID 1032 wrote to memory of 1788	1032	chrome.exe	87
PID 1032 wrote to memory of 3604	1032	chrome.exe	88
PID 1032 wrote to memory of 3604	1032	chrome.exe	88
PID 1032 wrote to memory of 4320	1032	chrome.exe	91
PID 1032 wrote to memory of 3464	1032	chrome.exe	90
PID 1032 wrote to memory of 4320	1032	chrome.exe	91
PID 1032 wrote to memory of 3464	1032	chrome.exe	90
PID 1032 wrote to memory of 1668	1032	chrome.exe	92
PID 1032 wrote to memory of 1668	1032	chrome.exe	92
PID 1032 wrote to memory of 3488	1032	chrome.exe	95
PID 1032 wrote to memory of 1988	1032	chrome.exe	100
PID 1032 wrote to memory of 3404	1032	chrome.exe	103
PID 1604 wrote to memory of 2468	1604	msiexec.exe	106
PID 2468 wrote to memory of 3236	2468	MsiExec.exe	113
PID 2468 wrote to memory of 5028	2468	MsiExec.exe	108
PID 2468 wrote to memory of 4540	2468	MsiExec.exe	109
PID 1032 wrote to memory of 3236	1032	chrome.exe	113
PID 1032 wrote to memory of 3724	1032	chrome.exe	114
PID 1032 wrote to memory of 2988	1032	chrome.exe	115
PID 1604 wrote to memory of 2988	1604	msiexec.exe	117
PID 1604 wrote to memory of 1896	1604	msiexec.exe	119
PID 1604 wrote to memory of 1424	1604	msiexec.exe	120
PID 4524 wrote to memory of 3724	4524	ScreenConnect.ClientService.exe	122
PID 4524 wrote to memory of 4196	4524	ScreenConnect.ClientService.exe	123
PID 1032 wrote to memory of 1600	1032	chrome.exe	126
PID 1032 wrote to memory of 1600	1032	chrome.exe	126
PID 1032 wrote to memory of 5052	1032	chrome.exe	127
PID 1032 wrote to memory of 5052	1032	chrome.exe	127
PID 1032 wrote to memory of 928	1032	chrome.exe	128
PID 1032 wrote to memory of 928	1032	chrome.exe	128
PID 1032 wrote to memory of 1772	1032	chrome.exe	129
PID 1032 wrote to memory of 1772	1032	chrome.exe	129
PID 1032 wrote to memory of 552	1032	chrome.exe	130
PID 1032 wrote to memory of 552	1032	chrome.exe	130
PID 1032 wrote to memory of 2924	1032	chrome.exe	131
PID 1032 wrote to memory of 2924	1032	chrome.exe	131
PID 1032 wrote to memory of 224	1032	chrome.exe	135
PID 1032 wrote to memory of 224	1032	chrome.exe	135
PID 1032 wrote to memory of 4068	1032	chrome.exe	136
PID 1032 wrote to memory of 4068	1032	chrome.exe	136
PID 3148 wrote to memory of 2664	3148	cmd.exe	145
PID 4524 wrote to memory of 4284	4524	ScreenConnect.ClientService.exe	146
PID 4524 wrote to memory of 1272	4524	ScreenConnect.ClientService.exe	147
PID 4524 wrote to memory of 5924	4524	ScreenConnect.ClientService.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://proposal-q1.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff8a065c728,0x7ff8a065c734,0x7ff8a065c740
  2⤵
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,7952219449244525496,6520937128920238108,262144 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,10757475922512666627,6220552475233696563,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,16022909225151641659,5313822184396282790,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,11656697120503030492,16287704842840393452,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,14932793838763855280,10089945941287630083,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,6031834497689952997,13254067700722358173,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4468 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4940,i,10550926452864283009,6326545538492773883,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,6349144156511724283,6337131006423596271,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:1988
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,15890413864196792788,13549922013828787936,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,4146009118406323543,9456715743985465959,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,2447361319540423965,12370189377187281626,524288 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6092,i,9591967975965072684,3511011090871549098,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6136,i,16429200205751462914,3245382375464614334,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6220,i,9492793640126937501,16230405995528266704,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3408,i,10722169754553962263,9666984009636590036,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5748,i,9793573383346147726,6774005379548700070,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5684,i,7917528543559352161,13768230288099582031,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6316,i,12776917868381315805,17424727367500263775,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6684,i,6849635920174507948,9502723823257813812,2097152 --field-trial-handle=2032,i,6369616016269890387,7591564292376807502,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:4068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2668

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7CA2150036DD62438CACDB70A7437294 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240732015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3236
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4D7B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240733578 10 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5028
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI54A0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240735453 17 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4540
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2988
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7C8FDEAD817F75432AEF55237801B8F
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1896
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1E4AA53F818596F541D9B3078258DB8 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4236

C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-ipy1v0-relay.screenconnect.com&p=443&s=037a6dba-2899-4029-a7d3-946d52cb2cb3&k=BgIAAACkAABSU0ExAAgAAAEAAQBNwzNoPkWWzH%2fa9z%2fPeiONpGniUH5Bghhkr%2fO4LbdIM3Wzr6esieRjKDAe3whOkddC8Mh7A%2fAxKPLzSOO9ibXIBUvW965wbgndW6sq%2buIxAANfzB7xmjXUMwBAXbFFw3GchmRX7%2bKt3PEkzMUjRFL8oy4fv6my98s8IHZvGJcegZIP8hWUzvEM4ZzDvmAeZ8L9Cjx4QZTzdP2yTZKXnDI%2fda8hovRloOg1ZAF9I9Wh91lW6ZwQ0R%2b5Z7k8RgSB3GtalVDzs6EtoB7dVMg2wtgYLgkZj%2bvubWx84HKrl1jvHUqzVf1K1tg97dvgROndq%2ft2maQU6D9sNig7ydkvOy7V"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe" "RunRole" "c39ad17d-a97d-48a6-b1fc-d027743e9488" "User"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3724
- C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe" "RunRole" "36785d09-5dfa-449e-8f1b-6bd8c0880362" "System"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe" "RunRole" "afbaf649-adc8-4f19-986c-2237758fc30e" "System"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsBackstageShell.exe
  "C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsBackstageShell.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1272
- C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.WindowsClient.exe" "RunRole" "7b1ec165-593e-4efc-8766-57252efdc266" "User"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  PID:5924

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5584

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3508

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5192

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\system32\NETSTAT.EXE
  netstat
  2⤵
  - Gathers network information
  PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a7a1.rbs

Path C:\Config.Msi\e59a7a1.rbs
Size 214KB
SHA256 551e32325a9f1ba2584302634ebafa61d9d9b206dc3b36f858f30bd3929d6718
MD5 13a0b9fda06c8b2311f0c215cba6e430
SHA1 270727f1f7a269248a13334b1e4c9ae94d891aec
SHA512 34368654bd422227b2bd5e7aa568c28b14a33414ea7936d266dfec10c8de95791c2752d2ea8b0928b342819aabcae87f11928553df9abdfbd4100af96e3fbbf7
SSDEEP 3072:AG9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGI:AGuH2aCGw1ST1wQLdqvI
TLSH
T119248C227094807EE7FA1A32D93E9A71BE7CF6640760C59EC3848C1E5D604D06BF6B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.dll

Path C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.dll
Size 92KB
SHA256 78fa9cf69577f6990275c7c472f7114f9d0c85e660f3b9c81b085fc3cfbc8673
MD5 20b930dc08fde485186d7687a48779ab
SHA1 0142109ebe6b95d9704f0954c232fc8ad2f25630
SHA512 a5f612f7aa678cf37d7b2f7bd6c490d192397ea62f6dfe3ec798acef610fb6b252ca073bbda14d2f88c771a0a34260308132ba26de9cdf180a574c0310a83b87
SSDEEP 1536:Vzu1ewsuwDP/2ovANyI9xhpxZUuQOV+eGI0ZUazxvmVRo9dE7h:Vzc2j/BAkI9JXQOVAIAUazxvmVRoTE1
TLSH
T1F6935C4293ECA92BC9DF0E38B461F26106B1B913D9E6E7D46D8860DA2F527C11F1439F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientService.exe

Path C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.ClientService.exe
Size 93KB
SHA256 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
MD5 1973034f7b83f666cbd3264bade6e6e5
SHA1 51340eee61b2b3df88bc48060104a32c0f101b4b
SHA512 8a28d7a5e347fe7d7d9977b74eaaaa6ac03ac615ed236235a28d2edb5d2f123945c98b8ea5b7713d3e4d034db580fd530b82c40c98162a7bcb259c2c8b384243
SSDEEP 1536:Lg1s9pgbNBAklbZfe2+zRVdHeDxGXAorrCnBsWBcd6myJkgoU0HMB7R:EhbNDxZGXfdHrX7rAc6myJkgoU0Hk1
TLSH
T12B935B13B5C28872D473193158E0DAB09A3FF9615E21DEAB3788022E4F742C1AE75E77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.Core.dll
Size 582KB
SHA256 4eab8752d05cd31bafd07edde7d18061cb63eea99af3132460e6dc08bb5f9e73
MD5 fb7b3b452a84b3c591abd35f1cf68eac
SHA1 b6750e1e287c36199294215d49e4613f43d8d271
SHA512 a20afb8d8cf1926d7bf9a05b71edf544f85bdeadb2b8733446b39d9f893bdad2659d023544e50f8bcd4fc8af4588aa8e0e60414ecfb7931e96895d8fac65da44
SSDEEP 6144:GobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7x:fZnAuhy7CsJlHiWKPYbhN4Ao
TLSH
T1DCC48D3073A4A776C5AE1B7AE072619503B0F413659AF34B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Program Files (x86)\ScreenConnect Client (aabd5a2550667f57)\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 ec4de5e6e9c079a30a5780d79ee662e0a4c6d009f0e3f911edc560973fb17d1e
MD5 d55cdc5fcefe87de68c201bdc08967b1
SHA1 be13fc7f876f28eb388e8a446d369a963516e30c
SHA512 9df975e885af260ec2d14484852260be64b07e576fc5808181ac7638bf69a6fd7006f53aefeb9116da8d3604c27ccef99356fddc063120819255184ac11bd7bc
SSDEEP 24576:kkFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUJ:xFuqJkGYYpT0+TFiH7efPU
TLSH
T14B85BE41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 727B
SHA256 d704a1cd54cb7999efe04bad510c4e7eaa83f02a6e9349a8af859742095ac455
MD5 bb82137f3a4d4a80b2d7c1a198a56dbe
SHA1 e369ac5767fcc4e6e3697102c9daf2d9d81338bd
SHA512 e8dbb063e649c50e4ee2acad59a2b1ca9c53296bc50764d5be07f58a4cb03becc94eb6db1efe580cd5cb2839d0e212e20dd70b71cbcf60d72979bbe87945339f
TLSH
T1F0016502959886C1EE21C8B7EFF75A607654511279EA460B023213D4A5996BA0B224A6
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 334c578d56dbbcfd3bcbd26e386ea1fd23f5f37540edeb50ccbac2e86edfa788
MD5 e368daf6633edc6828f84458e65e1378
SHA1 99d1ff7cfc14c2a754bc37e595f2392d36435199
SHA512 cf3a519b786a8422b6b46e80e71e0ae67b6504f4720eb9e2b2a6c22b25ff8724659d52387c741958a54d83924f00799fb049092bc7f3eed02cf941eca8b1e5c8
TLSH
T1390160030C651902BDC3C9D6CBE86EB92BA7D0CC1AC4C3A2371888E424AE1E69C62848
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_59E89BCE9615F2B61F2F2C691688F111
Size 404B
SHA256 d3c1311c2e11b76aefed76e428f2aa4f41aeacff77ef32e0943bc441ad418e5f
MD5 b6f75df4bc332ee920e2cef385b09354
SHA1 56bfa4bb57a802baaeedfffe69af5ebfd8a2d5da
SHA512 c2b2a05f73b57367ce65bc2d7ddde360d096f5fcaa6c9f4618792dc446ec0dfc5851420c2fdb3084c705f2b480014b981385ebf3b53e3c04b7b48dd5fd9a9e3a
TLSH
T1ABE0C03431F544ADF0F6D63443F598134499F24A6441C278194053069A29A018CE3378
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 1f58adabe44c70e2e438467307de80df5a2f6f7d5f665c28b4a81bc9a50623cc
MD5 acd21484335ec6db161f3c5075cec412
SHA1 0e6c36125e3c9bd890b6a54c05b280d8cfe5db18
SHA512 88be4dba082edc7df916cebb3bbb13de847538403b032190de0171f7b77a6a5c03318cb93080e78cb82d0c65844170fcd8b60cf8745e6a134ed0d3b2279e4b26
TLSH
T142E0683C11EBA24FF0A09A3542E9A0710D89E202204086B91AC1430CB71BE414C10AB4
MD5 SHA1 SHA512 TLSH

Submit Download

338df32d-811f-4afc-bfde-fe56ffabf438.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\338df32d-811f-4afc-bfde-fe56ffabf438.tmp
Size 132KB
SHA256 571e263dd8977c89b35836211c364fb5ecb991233b041067237520b5878f9026
MD5 911969dc7d57ff13515ba26a0c14a174
SHA1 bfa55906cf8217cb72661010a9948adebc7ef502
SHA512 e4436014df146614791945f62558d191c763ca1c4b4decb26bf92cfc66c5f9a5a37c01d99b0b2ce609907a68e0207c0ffb743b6558e51e0a6f2c42eed31f2d43
SSDEEP 3072:ZhsIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:Z6Ptbmf1K49XLWbEPi4NTKlLzn
TLSH
T1C7D302713D05BCB4A9EEEA21A1402A15A9F8D90B953D7FE65CDE3F8C05A36D8C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 fd740c5526bb01f7594bb065be4727deaf7cb7d75f1b26cadffeaf9336d66869
MD5 c988fb05a2323c80ae25c977c64c1ffc
SHA1 2b26fc30a5b318ac59c8e4395c2f6dabef3e41e5
SHA512 91e89987693c888d11632f220eb67e654caf4f13399a9a022ca581c87aa1105079212482c9d7ace56060f791cc31fc0774b3bba4fb79af27a3a4311296afe507
MD5 SHA1 SHA512

Submit Download

1023a477-9742-4682-9e82-171dc27202b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1023a477-9742-4682-9e82-171dc27202b5.tmp
Size 12KB
SHA256 491dfbdeb61e70c4e2d67a8a31941a1f388eb068ac6207a7ea7530ef4f745fd5
MD5 304725cd003c7b48c55e378772f1c6dd
SHA1 776c1026dfa8e6df8ad573ab70c7e0375113141f
SHA512 2e8cd6e081994a609e56a3da7691280cf0d920002eed6afc0cdb872a93b555733c2b2ac6b400c5a3c388ea2a6a5ef7f3a11da37a5ed0a6bf04613c1886f5988f
SSDEEP 192:uRRGfeUlshv7AWpAPRp2D9+Hsb+WNn9KPBm2Jj9M1VyIsnAUge:uRRGIxzUXogwUPs2Jj9se
TLSH
T17642D82DAD14793B6CDBD22AF9657B53D7F9102134942E84E7FC892C24E7ACC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14d327df-16b3-4125-93cd-dd181ebeae63.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\14d327df-16b3-4125-93cd-dd181ebeae63.tmp
Size 12KB
SHA256 dd4389bcdd49b2726d09d60cd0d071b5718c4224fd1c520442abe5495bfbfe6f
MD5 8c921679fd5581cab01c2e40a5d31cdd
SHA1 1ca2488daff9f090a0d80fd555d93d3b434d03c1
SHA512 014ea94b7ba97e6e7c0836f079b2b98501df356a86b03e09bed9d0e0609c8e04669124718e280cfdcb4c2ed3628f5c5ccd91a3ace21e3d73935d843e339b8a86
SSDEEP 192:uRRGfeUlsdjv7AWpAPRp2D9+Hsb+WNn9KPBm2Jj9M1VyIsnAUge:uRRGI9zUXogwUPs2Jj9se
TLSH
T18C42D82DAD14793B6CDBD22AF9657B53D7F9102134942E84E7FC892C24E7ACC222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d140f7b-8ef0-4267-9881-2a2baddbf3fa.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4d140f7b-8ef0-4267-9881-2a2baddbf3fa.tmp
Size 12KB
SHA256 13344633b4095aa3471e0e4408f0779663633737ebbae642cfd80ec0d800b589
MD5 c7b419f6e3f809b76e379ef97a2d0b8c
SHA1 754d2b867cb49d239f7ae176d7515981e19e8ec4
SHA512 e5ee6b219f1a05e9fdf4e8b198af42cbca147ac5ed3612c4269d55af635994ad675155ba695b11590aff0034b5acc553ad547473b56887cbf86d7b209d421f95
SSDEEP 192:uRcGfeUlsov7AWpaPRpQD9+Hsb+WNn9KPQm2Jj9MBVyIsnAUgE:uRcGI0zWXugwUP72Jj9WE
TLSH
T16052E82EAD14793B6CDBD62AF9657B53D6F9202134902F44E7FC892C24E7ACC2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b05ead7-a826-4d69-8b03-10ed81cec815.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5b05ead7-a826-4d69-8b03-10ed81cec815.tmp
Size 17KB
SHA256 32e6c0a3f05682d1e24f62135a16a559239bad390f6d29f2c3f6be9606c5db00
MD5 dd640a034f45376f3fcaa0a994fd4c07
SHA1 84453886df3f8873a24f080834e8931fb45a049c
SHA512 f4914452222e94317f3fd39a2a4bf91384dae0f2bcb11a077cd1c0143c27df3b5988a42d81e29fc71842f0242fa488537d4bbb16e9e30f0e2c39407ce6dc1661
SSDEEP 384:nVjD27KxkXqKf/pUZNCgVLH2HfgslDZ7pLuLceSx8XODDS+ErU3s7HG+I4QEry:nFD27KxkXqKf/pUZNCgVLH2HfgsFZ7p5
TLSH
T1D772E8677C4899370F94CAC8D8267F4FACB9025B65ED886553FA582503D4BCF110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f8f8a71-9884-462d-906a-9df0ac50d238.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5f8f8a71-9884-462d-906a-9df0ac50d238.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6573832a-c0b9-45cb-a667-e8485abc38ee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6573832a-c0b9-45cb-a667-e8485abc38ee.tmp
Size 414B
SHA256 2fcbf9a434f6889f7d58f294bb6cf0b1e8750951963b69e77f4f5f6dd71be31b
MD5 f99d803c919b2ccb29eb0a8428d701f2
SHA1 47fa607325e466125bfd2397b07006cbacdb591b
SHA512 1f02b9ca3ea35e314827d701e080be8a6d70491436f31e5a2f7ad916e04c3e56378ca182651c7e500e43deaf902de447878ea8659abe528ad12669145dd7401d
TLSH
T12FE0E5AAC915A86718F91E2DA0904746E71423672F90890F3A3C41088FB5676459A95C
MD5 SHA1 SHA512 TLSH

Submit Download

95bc1ab4-7e77-45ca-bd8a-a3ecf6f5f02c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\95bc1ab4-7e77-45ca-bd8a-a3ecf6f5f02c.tmp
Size 13KB
SHA256 82d504b4b35889f6e506ec73be1e36240e99484ef1516db012ccc364ccb06e7e
MD5 fdd5b1e79d2f8592d4fb4aa0eff56709
SHA1 d7c759585405ccb4eca53c524cca2a6ed51e3fe5
SHA512 37b01240a97f0250ef4e261437652ffa94cd098cc55bfac65f1ad2b72ea76fe47a924d8224a29aca5cf1438074c72c3cce29b784900f2966c10fa131f3cf3039
SSDEEP 192:aRRGfeUlhov7AWhaPRpQD9+Hsb+WNn0j0Om2Jj9MBVyIsnAUgE:aRRGN0zeXugwE0l2Jj9WE
TLSH
T1A852D72EAD14793B6CDBD62AF9617B53D6F9102134901F84E7FC892C25E7ACC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 430478bcf53d05e2c0f9ed1899a957b88806272eb24bba887fe8e271cf49fe95
MD5 4ec4e5ed7de875fb99e3d50f24292911
SHA1 cfbad2cdc9e4be20588766a30fb44a816c73f8c5
SHA512 efd1e2f1b266f36e0f249811b87686f37c43576833f37896ae900338b12b71ba5819e0f1c53111b771f56c36eabd3861f555120aa2180d44e1be1a7f8f8d4ec8
TLSH
T18D21EB1DAB838421CF8B21BB1BEEC90551663C8EBD10D34E934974D8F806AB130A107B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 53c3273f8d3c3057ff177e732cf45cf8a8f766f51a0ac73dfa489cb811d28e39
MD5 2d07739f2546b2aeb54ff1a446b96130
SHA1 12ad6d5b91dad719ff39695e0d67d0b7cc0c2b6d
SHA512 35cff9a45619c7ef9b67391a37da3d73f2c925c53d22d093d67f59b3cc742b3ded3f618fe3263d43e4ba725c7c14351a7dc70e8cfd710c370f58fd3bbb079fe6
SSDEEP 3:MsEllllkEthXllkl2zE8s//l:/M/xT02z4
TLSH
T1E24402046BD0480ACE001030401583900360E51019119783645154125D8A6D04C10418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f90840b-749b-41e8-b2f0-ffa8a2c0793f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1f90840b-749b-41e8-b2f0-ffa8a2c0793f.tmp
Size 8KB
SHA256 713664fb92bf69e6fd19e0346748dde950f342f4937c4aa70b922849cbfe479e
MD5 19a9c8d2f02eb308db4209129eb30549
SHA1 da26fd87773ec7e1fc303d807b6a4292edd6fb48
SHA512 026ea12749a19068a11b8d724ece6e0b147681b4531c7cfe001fb9e63ef4744030c4a06d9dcb3b8b37d3cbb7c9e31a9bfc7994a69772bcf1d4fefbae868a66e2
SSDEEP 192:D1lgrR2iTaI0Gbtvf3GKji+I5VIBNPHpaPFfPcvfiNeg5b+ZiNEj:D1lgrR2iTaIHbtvf3GKji+I5VIBNfpaC
TLSH
T13502CDF7C3E8952EC95166F49B15BF2FCE291A24431C3C2688D4AE1BD7E2872D20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47736831-fefe-4df0-b17b-8eaaca585fe9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\47736831-fefe-4df0-b17b-8eaaca585fe9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

67911284-d544-422e-9f55-7fd2fcd137d4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\67911284-d544-422e-9f55-7fd2fcd137d4.tmp
Size 1KB
SHA256 07ab666cdbf92dd00a914ee2f7e9bbd5e76a4be440ff062a2047c86e952d7f44
MD5 5846fbdba791dabe30194d61239366e3
SHA1 aa046c0ddeb134c96cabbb0a7f5a39589c226497
SHA512 659a7ce53fa0fd390aa37ce84711968d9fea2a10e3d1aea6aa3ef6bea83cc1c84370af8572fffebe6ee0b7d3242904f074f6dfbebab97e8ac64020cc39a73e6a
TLSH
T183418AF793F4997E8A1192E4EB156E1FCE790624031C3CA688D46E2B97F2972D10078E
MD5 SHA1 SHA512 TLSH

Submit Download

9f273cd5-9ab6-4271-852f-5eef7111e8fc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9f273cd5-9ab6-4271-852f-5eef7111e8fc.tmp
Size 1KB
SHA256 2a8be77d4fe327bb748e7cc9bd059eb00042bb9dd319cb1258f7419da0122799
MD5 e67a17b05d186605b046035ae3eea713
SHA1 3726236fc31e4696d6885a38903632705a91389b
SHA512 d0d7a8b2ad9db82283bdf792f83c65f7f094ff69a6431d86c01437939425e028c25ed36152280536019c0a247ce99adef9e6293ab7db3390b556d743b629f234
TLSH
T112318DA792BE746B407E14EB1F147C0925B6B431514368F4DAAB432CB0C28B75F12072
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e1852c65b8478e7b0ab5a0b6b6b9479621e146aa48ee41b6afed8440ebc213d3
MD5 f09134057e702c2bd727f4589515e58c
SHA1 46d480612786b76efad649a0990d32d55edcb941
SHA512 057ad4c702fd5fba608a8b266aa844c2a99b409c99212052cb80402921185336ac191cabeff6c5d9429a3226b859fcbd953eec325a44b1791c0587ed3c0a9ee9
TLSH
T167B01204C0426341C05202F0155154C83154DF24EB09130281F00D05F83A961C01B094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 070c776b4ebe3d05c7ce1afdca6c98bf4fae869fb448c57bab8b10cebeaeac33
MD5 c87a02a3eaa596c7708fdf4cf83f040f
SHA1 cc1df3bf7501ace28399ea2209abce06c7cc1377
SHA512 f20e33198133268745b3cec1a77efa095dab5b8406aa1fb62c406417933856fbd6628d6d2560766d0bdabdb4f549a07c2a8a38f11a8c9b7315086cb0fa3bab9c
TLSH
T181B0025AC2027232C04643B026D6A5D9B1E0FF25C7031312DBF13A6EDC6677A493B5A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 d4481d7dcfa2a9be7734e80f2990276597730f22398c4801acefa45029fb847c
MD5 01a483275a44d9b30e28d27cc3bad615
SHA1 5c7681dad237fa10c5ecf69fcc267fa1063f8eb1
SHA512 1e7d289569f24e3a786bc1324cb252b0fc026a65f557639ec47cc9517ae908a0308cb117ca82c43d38ba6a07fce4fbac704d018d6171ee59a470baa7efff9021
TLSH
T164A002E415590340C012157492CB23D01318EF24865B8B42D0E54495885156B5103705
MD5 SHA1 SHA512 TLSH

Submit Download

b08dfd12-37a5-425c-9474-353df74df40f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b08dfd12-37a5-425c-9474-353df74df40f.tmp
Size 14KB
SHA256 fb309d58326ba164a71f48a470b281a51fc39cbfedfeb01f581514c7cbf0ee29
MD5 8211e14ac0a3a31108f3472662f2f9bf
SHA1 1c60a019fc853e2edf6fd12b107b0402373bd7c2
SHA512 6cd7bf913875ba52bd6efecc89aefd6c67b9c9f223f2e53c1347d757d7bcd8178d4549d1679552cc23958ae3102dd59ef99cd9d1845a5018cdb835acf36b24d0
SSDEEP 192:aRNcBzGfeUlhov7AWhaPRpQrQKP59+Hsb+WNHnEZ0j4Fy2Mm2Jj9MNlPyIsnAUgE:aRNmzGN0zeXWgwj72/2Jj9CE
TLSH
T1D962D86EA9207A7B6DDBD229F8517B53D6F9202234901F84E7FC8D2C24E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a90c27bf-044a-4f53-b6f4-0e1b07305db8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a90c27bf-044a-4f53-b6f4-0e1b07305db8.tmp
Size 132KB
SHA256 7adbea31a004d09760a247a86d9d0e30810e57be43c3385603a849f818443920
MD5 bac00d0ebf5a3423b9ded9c772b5316e
SHA1 8da3d05ad88f57861187ad4da5131e2baec36fbf
SHA512 f9507ea6375f70c64b7cd7f5cb743ddc3405b418c4cb2f683b9a38b49634a0dc01b54d59998afb72b2969ffea72c06e707743db4e4c0b4e0d9807a0d5e138df1
SSDEEP 3072:Q+IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:Q+Ptbmf1K49XLWbEPi4NTKlLzn
TLSH
T1D0D312317D05BCB4A9EEDB21A1402A16EAF8D94B95397FE658DE3F4C06A36D8C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d86afbea-b91f-4567-9688-596a04edaedf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d86afbea-b91f-4567-9688-596a04edaedf.tmp
Size 132KB
SHA256 d3aac57b02f2e824601107580422238f651eb0c9c0689acfc1cc7fb81b89082e
MD5 0baa2dae0440248db28afb2f847256b2
SHA1 0d8c523844c1d750abc7955d77be5da4f4134599
SHA512 025d77c27ed0845172b2ca7b4a6100cae7ec76f88667b3e3542d208ab08670fc827c42a3cd3e7d079c60931c7c6bc0c877f8411f155f655047cba809fbb95bb3
SSDEEP 3072:ZvIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:ZXPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T1BDD312717D15BCB8A9EEDA21A1402A15A9F8D90B953D7FE618DE3F8C05A36DCC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eda209e7-9785-4dfe-9428-f882e4f828cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\eda209e7-9785-4dfe-9428-f882e4f828cf.tmp
Size 132KB
SHA256 ec8b5db938c1c193ffe9704cbd83158b3db4f1d5ea6337c4ec948e94b3304c63
MD5 32b7a89c01ec024825a593a8a22f32e1
SHA1 01d55c6985718fee22f9656e4411f6304309a841
SHA512 874b4c872a49b72309a246865478bd55b60b03c5775857bfae63bbfd16047b84732b77979c8479d8e5d704d53fbb1c08806d63a1b2005ac7d4cd30897b9bbbb5
SSDEEP 3072:ZCsIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:ZLPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T19BD302717D05BCB8A9EEDA21A1402A15A9F8D90B953D7FE65CDE3F8C05A36D8C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee7886b2-967a-4898-9978-7a5105bc1b30.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ee7886b2-967a-4898-9978-7a5105bc1b30.tmp
Size 132KB
SHA256 1bd5ce1d6cc7af6f49a4cb277ab14fbb88980815fffb4ef1043567004645dcf9
MD5 8f679267cf5ed4888905e69a8953fb65
SHA1 4088ab33fb1cbf6a5cf96c57b047c4e8f3f1e8eb
SHA512 c8d3e16331b3b717eb9550b2ab667e69b1ce8d627392bf6983862dddc508891ee7c1d2103de56f785e042feb8f73f826b1853a0d3dcd7045c536ecf0e8af359d
SSDEEP 3072:Z+IvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:Z+Ptbmf1K49XLWbEPi4NTKlLzn
TLSH
T10ED312317D05BCB4A9EEDB21A1402A16EAF8D94B95397FE658DE3F4C05A36D8C304C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efe3d126-1c4d-4ec1-afb5-e7bbe0a0a5a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\efe3d126-1c4d-4ec1-afb5-e7bbe0a0a5a3.tmp
Size 131KB
SHA256 3aad1e460232a912dfc39def84282a5789461acbdc647f5a1f280842b3d76581
MD5 dc098328265a07f8745549729b09ae9a
SHA1 816086542c98f4f916f8d2f491799f945a7b80d2
SHA512 bb5e6b3e62ef4098f8499b224f6e2e156cc378879f42934893d800a2607d0fdaf8b14939462abd4b7b919871fa1d79a45ec50a64dcdcae868cba494784e15825
SSDEEP 3072:7KIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzn:7qPtbmf1K49XLWbEPi4NTKlLzn
TLSH
T183D312213D01BCB4A9EEDB21B1906A15EAF8D94B95397FE61CDE3F4805A36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
Size 746B
SHA256 707c0e90ab433305fb10151c93aed7664319ba55ec59b7304d38481af4f5a4a2
MD5 4120a9b92f238fb49739d695b67fed65
SHA1 1151a9c25533be5b1d497076db8228ab6c97ec59
SHA512 feaffad013d229b8d7395dc9bdcad5b948183b16ac41c41c5f5d923f1512e0dc24b56073f10eb88b0a5e2a41980c16d04ea4a8877f47035732fa317d165804d8
TLSH
T162017B302272B1D549022F53191C2A8907BF43957968BE1C79A9225FD92B05B6F222E3
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4646.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp
Size 1.1MB
SHA256 400ff5b9a4439339876282909b23c397ffa208f4bcf64460fa2521284acf0b6e
MD5 44c34653e3a134ae0477da3063fd2ba4
SHA1 d1c872aa0b4a098d71153f5a0f526404590e385c
SHA512 63c937dafe933c1b65e9b82c77205788693752ddec6b7f9d6153e89b1242bcee2dc24bd17704b0cd99702a3d0b4ab29e3f312e0399fb9554de413cd736c3fba0
SSDEEP 24576:bUUGGa/LkG02xsOx2sk77KuR0KYFze9qB6qxyp+8lkmhihP:sGa/LW2aOcs47CvFK9DwvNhP
TLSH
T14235231033A54579F2A537714D74B3B139BE75722DB0804E7B8E49B90EA0BC2E9B8723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 172KB
SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
MD5 5ef88919012e4a3d8a1e2955dc8c8d81
SHA1 c0cfb830b8f1d990e3836e0bcc786e7972c9ed62
SHA512 4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684
SSDEEP 3072:FkfZS7FUguxN+77b1W5GR69UgoCaf8TpCnfKlRUjW01Ky4:x+c7b1W4R6joxfQE
TLSH
T14E045B2563FC473ECAEF87B4E2624251E7B2E2E97113DB0DDC8541AA2522780F792753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp-\ScreenConnect.Core.dll
Size 572KB
SHA256 74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7
MD5 b759084c5614aacb33fec8faccd0c5ad
SHA1 d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4
SHA512 5fc322836cfbf4cc93ac0b5c4d9a64a68507d372ad0bb731902a50b07bd6fbf0f40fab1a77028cc9c63b0f0f93158f82d274fe7abaa64a01a74b8879213d80ae
SSDEEP 6144:SobZO37pir0uomvrTk8AG2sTwR87HNSxyoiuHiWm9kzKY7vhNS/chwDTax4kzm7c:DZnAuhy7CsJlHiWKPYbhN4A
TLSH
T16AC48D3073A4A776C5AE1B7AE472619103B0F413659AF35B7B85E5F92DC23C88F107A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.InstallerActions.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp-\ScreenConnect.InstallerActions.dll
Size 24KB
SHA256 2022f13b1f562d3cbef3a3926f0370a2de64e57ff281a121f90001a47499a356
MD5 8cc4a6f44f2afd49b9e8810daad0ebf7
SHA1 022165dae77ac02c8b20e43c4aeefe9566f98171
SHA512 491eb66bbcfe521cae8e2c2811fe013b23d6f2787f7075c625987769eb9f92d984615f5c12c9ae21df57f4f25ffe59a3670bb5e9f57934054ce8edf1c36ffdd7
SSDEEP 384:MCazzV1VTsaS8hQlLkmoAEV7NaNeirM0dbMsFkjvZB720Wi2X:FazC9EVMcLv14
TLSH
T1C7B2D620678DE27AF9EA1634B563FBB001B37DB3CCE9DA8565A420153D253E04FB5B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.Windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4646.tmp-\ScreenConnect.Windows.dll
Size 1.7MB
SHA256 93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193
MD5 9edc01ae0bafe0a1c610d9c8014ad563
SHA1 5fbf0ba61aaaae5b506d78ca862286a676a61fbf
SHA512 366acaf50cef7626e6644dfd2e8a3c878de533be51f03e4ac205139bcf210615f5a0b0ee40d5fc4fe562eae7ee7d025e45b9ccc3279901ce400578441ba45928
SSDEEP 24576:okFuqFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT01krTFiH4SqfKPTsUw:NFuqJkGYYpT0+TFiH7efP
TLSH
T16085BD41E2C364F5D46B047888BF572ABA743C080365CAFB97D4AE366D33BC09A36756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Users\Admin\AppData\Local\Temp\MSI4D7B.tmp-\CustomAction.config
Size 234B
SHA256 7027b69ab6ebc9f3f7d2f6c800793fde2a057b76010d8cfd831cf440371b2b23
MD5 6f52ebea639fd7cefca18d9e5272463e
SHA1 b5e8387c2eb20dd37df8f4a3b9b0e875fa5415e3
SHA512 b5960066430ed40383d39365eadb3688cadadfeca382404924024c908e32c670afabd37ab41ff9e6ac97491a5eb8b55367d7199002bf8569cf545434ab2f271a
TLSH
T18CD0A70405D0FD1B5E231A2337524559FF34B1E290A44408B06F3A130A220CD4757317
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.WindowsInstaller.dll

Path C:\Users\Admin\AppData\Local\Temp\MSI4D7B.tmp-\ScreenConnect.WindowsInstaller.dll
Size 137KB
SHA256 361bbc692084841e4c8d22c89ca89c711d0fe17bc8759241736531a2f28de25b
MD5 72899e40e3d32282fd63c34b87b9385c
SHA1 5ad8f5020613acfaa84259809c373cc144af9076
SHA512 d2ac73c6b7b093fa209e78f3a8e95e7b9487fa1ff802f9928ad10fa2178cbfd545afe3f7644dc67a4d988280a4814955a46d1984d755aea7409836813f0de2e3
SSDEEP 1536:fU7AWOVH+oj12lAW5SDVzdi43b12vPDKukpQBhX6dhloZDutUVfh5U3KiQtlJxMg:fUADVZ12l4L12v2ukpQQWVfj2H6oG
TLSH
T18BD3393463AC9A77F6EF5ABDE470B1440BF2B527B4D2F78E594864F818127D04A2036B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 721655.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 721655.crdownload
Size 9.8MB
SHA256 a9e09d4960a1f927facdef0bd6409ea0c4da77b73f71e72425e7569e632f050a
MD5 add0d05d6af3f1af8762e204abcebaf3
SHA1 e38d1f62b2f5d58774b34d2676c09a6f46784f01
SHA512 d39d368ea14a8ab745cdc556de791a4e9fd228ceeb0d87301e76dbc7a5380ad8c5e1f7ca7098f4292671752e3e4f935a51dfd2cee0d80c5e16f03debbd54d148
SSDEEP 98304:wMn1Giy8E1PqhyG6ztZNK9aNGZMn1Giy8E1PqhAMn1Giy8E1Pqh1Mn1Giy8E1Pqh:zZWiEz3I96VZWijZWi0ZWi
TLSH
T122A6232123FAC168F1B61B35D93965B56936BD12DA22C04F1364BE6E3C31F949A72333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

MSIA9E3.tmp

Path C:\Windows\Installer\MSIA9E3.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
TLSH
T129147C326494803EE7F91A36D93E9A61AE7DF6241760C99EC3848C0E5D604D06BF7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kcemrkni.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\kcemrkni.newcfg
Size 683B
SHA256 4d8d0b0246f22110e1bc5941d6cf9c11875b14da2b6a690e00b76e08adef9ef3
MD5 9e4a5bdf787ac688f5f0cd4e4747d331
SHA1 a8e9c2ae829a970a3c26b1d8246c27f1e75a21c8
SHA512 190adba65ba7ae2819529eea4bcdcc4ffe0cedded101651b5f97e97b01f9475dea8b6f0ad4662b663c1fa480efaf992e63cca32f9666a1f89bd6409482b6d088
TLSH
T1810144A5B1C0AE4B02A32E33D6224345FE31269B02A520D874AE213B5F315CF07E32DE
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\user.config
Size 520B
SHA256 4d7c8e161b510b583555ca37ca34ce1fe8e4e384f407e766096f54540f606a45
MD5 f01bc61ac633209d27f4d90586bc01e2
SHA1 c3cf586fb4d9d2990e28f6d14b700c8df29f97f2
SHA512 02077c5a42d2d3556cf38cfe4471cf29448a23a9295542cf24ebe375d79e4142f0ee11a8a9564ebca65ce63a10a0601cf7bcf61016ed0cd8994c12e15367c62b
TLSH
T144F0E9A131806E4713636E23C5114745EE72669B0565249874AF217A5F315CE07A32CE
MD5 SHA1 SHA512 TLSH

Submit Download

w5k2pcxv.newcfg

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (aabd5a2550667f57)\w5k2pcxv.newcfg
Size 883B
SHA256 924f4aeea66464ed513e6c576a1d895faf33b45aaab62911435d19790e642647
MD5 8e28f332b0b5682c69f550e32d76762c
SHA1 54e6cdfb09e57b6cb0945038ce27eac387329716
SHA512 3175c1f59ca6275dd539fbdd83f047fede66cd14b764959c668222e55d3fe932e1ec83f754657c544e78aeb1e9967d877ffcf4c67fd13edb16b339bf6b91a066
TLSH
T1A7116B59B1C0AE4B06B72E32D5214386FD311657416960D834EE213B5F305CF07E36EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-719-0x0000000000D10000-0x0000000000D26000-memory.dmp

Download

memory/1604-725-0x0000028599B10000-0x000002859A5D2000-memory.dmp

Download

memory/1604-326-0x0000028599B10000-0x000002859A5D2000-memory.dmp

Download

memory/2068-378-0x0000021745EA0000-0x000002174606D000-memory.dmp

Download

memory/2068-381-0x0000021745EA0000-0x000002174606D000-memory.dmp

Download

memory/2068-367-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-368-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-369-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-370-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-371-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-372-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-362-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-361-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-363-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/2068-373-0x0000021748890000-0x0000021748891000-memory.dmp

Download

memory/3236-115-0x0000000005570000-0x000000000559E000-memory.dmp

Download

memory/3236-127-0x0000000005950000-0x0000000005B00000-memory.dmp

Download

memory/3236-123-0x0000000005700000-0x0000000005796000-memory.dmp

Download

memory/3236-119-0x00000000055B0000-0x00000000055BC000-memory.dmp

Download

memory/3236-128-0x00000000060B0000-0x0000000006656000-memory.dmp

Download

memory/3724-324-0x0000000002670000-0x000000000268A000-memory.dmp

Download

memory/3724-325-0x000000001BAA0000-0x000000001BC28000-memory.dmp

Download

memory/3724-323-0x000000001B760000-0x000000001B910000-memory.dmp

Download

memory/3724-319-0x000000001B100000-0x000000001B16C000-memory.dmp

Download

memory/3724-320-0x000000001B510000-0x000000001B5A6000-memory.dmp

Download

memory/3724-318-0x0000000000550000-0x0000000000600000-memory.dmp

Download

memory/4196-328-0x000000001B1D0000-0x000000001B200000-memory.dmp

Download

memory/4284-721-0x0000000180000000-0x0000000180055000-memory.dmp

Download

memory/4524-302-0x00000000047E0000-0x0000000004872000-memory.dmp

Download

memory/4524-265-0x0000000001B60000-0x0000000001B7A000-memory.dmp

Download

memory/4524-271-0x0000000004340000-0x00000000043D6000-memory.dmp

Download

memory/4524-273-0x0000000004590000-0x0000000004740000-memory.dmp

Download

memory/4524-285-0x0000000004430000-0x0000000004480000-memory.dmp

Download

memory/4524-304-0x00000000049C0000-0x0000000004A96000-memory.dmp

Download

memory/4524-303-0x00000000043E0000-0x0000000004421000-memory.dmp

Download

memory/4524-301-0x00000000044F0000-0x000000000455C000-memory.dmp

Download

memory/5028-160-0x0000000005460000-0x0000000005488000-memory.dmp

Download

memory/5192-702-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-701-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-700-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-699-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-698-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-697-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-695-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-693-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download

memory/5192-694-0x000002246D3A0000-0x000002246D3A1000-memory.dmp

Download